summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2012-07-07 16:43:27 +0000
committerJo-Philipp Wich <jow@openwrt.org>2012-07-07 16:43:27 +0000
commit92e2e3f5670c019e0ad0346d5f82c02da0bd4733 (patch)
tree3488796576ba10f439a1bf55e48efaee16c57ec7
parentbb1488e5e7ae25aaaa740f074d8ab2e1f37fe700 (diff)
downloadmtk-20170518-92e2e3f5670c019e0ad0346d5f82c02da0bd4733.zip
mtk-20170518-92e2e3f5670c019e0ad0346d5f82c02da0bd4733.tar.gz
mtk-20170518-92e2e3f5670c019e0ad0346d5f82c02da0bd4733.tar.bz2
uhttpd: do not dispatch pipe error events, fixes use after free for cgi and lua scripts
SVN-Revision: 32644
-rw-r--r--package/uhttpd/src/uhttpd.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/package/uhttpd/src/uhttpd.c b/package/uhttpd/src/uhttpd.c
index 73f6e03..3237fba 100644
--- a/package/uhttpd/src/uhttpd.c
+++ b/package/uhttpd/src/uhttpd.c
@@ -573,9 +573,13 @@ static void uh_pipe_cb(struct uloop_fd *u, unsigned int events)
{
struct client *cl = container_of(u, struct client, pipe);
- D("SRV: Client(%d) pipe(%d) readable\n", cl->fd.fd, cl->pipe.fd);
+ if (!u->error)
+ {
+ D("SRV: Client(%d) pipe(%d) readable\n",
+ cl->fd.fd, cl->pipe.fd);
- uh_client_cb(&cl->fd, ULOOP_WRITE);
+ uh_client_cb(&cl->fd, ULOOP_WRITE);
+ }
}
static void uh_child_cb(struct uloop_process *p, int rv)